Redirect callback url to http endpoint

[sagarshah1983]

Hi everyone,
Can we have callback url configured to http endpoint instead of https Or is it mandatory for authorization_code workflow to have https endpoint? It does allow me to set http url endpoint but it fails during auth login flow.

Please advise.
Appreciate!

-Sagar

[Benehiko]

Hi @sagarshah1983,

Thank you for reaching out 😄

What is your current setup? Could you give me more details as I don't know of any restrictions Hydra places on callback urls.

[sagarshah1983]

Thank you for your reply. So I have defined the client with callback url as http://www.postman.com/oauth2/callback
When i login using auth workflow, I see this error on the callback originated from hydra.

error=invalid_request
error_description=The request is missing a required parameter includes an invalid parameter value includes a parameter more than once or is otherwise malformed. Redirect URL is using an insecure protocol http is only allowed for hosts with suffix %60localhost%60%2C+for+example%3A+http%3A%2F%2Fmyapp.localhost%2F.&state=1234567890

Not sure, if there's any configuration or a flag to work around with it and allow just http endpoints too?

Regards,
Sagar

[Benehiko]

Oh I see! I'll investigate this further and let you know! :)
You could try add --dangerous-force-http flag to the hydra startup command. Just note this isn't really recommended in production!

[sagarshah1983]

Ok I see. I can try it, but if it's not recommended for prod use, can/do we have some other flag for production usage that lets you set http endpoint in callbacks?
Appreciate your inputs!

[Benehiko]

Hi @sagarshah1983,

Sorry for only getting back to you now!

Hydra will prevent the usage of http in a client non-localhost callback URL. See #1231 (comment)

Maybe, a workaround for this is by using a reverse proxy running https in-front of the insecure callback running http.

[sagarshah1983]

Thanks for sharing the above link and clarifying different options to consider as a workaround.